Infrared Brute Force Attack Unlocks TiVo

January 30, 2019 by Tom Nardi 44 Comments

While the era of the TiVo (and frankly, the idea of recording TV broadcasts) has largely come to a close, there are still dedicated users out there who aren’t quite ready to give up on the world’s best known digital video recorder. One such TiVo fanatic is [Gavan McGregor], who recently tried to put a TiVo Series 3 recorder into service, only to find the device was stuck in the family-friendly “KidZone” mode.

Without the code to get it out of this mode, and with TiVo dropping support for this particular recorder years ago, he had to hack his way back into this beloved recorder on his own. The process was made easier by the simplistic nature of the passcode system, which only uses four digits and apparently doesn’t impose any kind of penalty for incorrect entries. With only 10,000 possible combinations for the code and nothing to stop him from trying each one of them in sequence, [Gavan] just needed a way to bang them out.

After doing some research on the TiVo remote control protocol, he came up with some code for the Arduino using the IRLib2 library that would brute force the KidZone passcode by sending the appropriate infrared codes for each digit. He fiddled around with the timing and the delay between sending each digit, and found that the most reliable speed would allow his device to run through all 10,000 combinations in around 12 hours.

The key thing to remember here is that [Gavan] didn’t actually care what the passcode was, he just needed it to be entered correctly to get the TiVo out of the KidZone mode. So he selected the “Exit KidZone” option on the TiVo’s menu, placed his Arduino a few inches away from the DVR, and walked away. When he came back the next day, the TiVo was back into its normal mode. If you actually wanted to recover the code, the easiest way (ironically) would be to record the TV as the gadget works its way through all the possible digits.

Back in 2004, there were so many TiVo hacks hitting the front page of Hackaday that we actually gave them a dedicated subdomain. But by the end of 2007, we were asking what hackers would do with the increasingly discarded Linux-powered devices. That people are still hacking on these gadgets over a decade later is truly a testament to how dedicated the TiVo fanbase really is.

[Thanks to Chris for the tip.]

Turning A Tiny FLIR Into An Action Cam With FPGAs

September 13, 2018 by Brian Benchoff 18 Comments

FLIR are making some really great miniature thermal cameras these days, designed for applications such as self-driving cars, and tools that help keep firefighters safe. That’s great and all, but these thermal cameras are so cool, you really just want to play with one. That’s what [greg] was thinking when he designed a PCB backpack that captures thermal images from a FLIR Boson and stores it on an SD card. It’s a thermal action cam, and an impressive bit of FPGA development, too.

The FLIR product in question is a Boson 640, an impressive little camera that records in 640×512 resolution, with a 60 Hz update rate. This one’s got the 95° field of view, giving it a very good specification in a very small footprint. This is a huge improvement over FLIR’s Tau camera, for which [greg] built a breakout board with Ethernet and DDR memory a few years ago. Once he found out about the Boson, he figured a backpack PCB for this camera would be possible and a great excuse to teach himself FPGAs with a hands-on project.

With an impressive ability to find the perfect part, [greg] sourced a Lattice iCE40 FPGA in an 8×8 mm package along with an 8 Mbit HyperRAM in a 6×8 package. This combination allows for all the chips to fit behind the Boson camera. Add in an microSD card slot and a few connectors and this breakout board is very close to being a commercial product, for whatever forward looking infrared needs you might have.

Improving Indoor Navigation Of Robots With IR

June 27, 2018 by Brian Benchoff 20 Comments

If the booths at CES are to be believed, the future is full of home robots: everything from humanoid robots on wheels to Alexas duct taped to a Roomba. Back in reality, home robots really aren’t a thing yet. There’s an obvious reason for this: getting around a house is hard. A robot might actually need legs to get up and down stairs, and GPS simply doesn’t exist indoors, at least to the accuracy needed. How on Earth does a robot even navigate indoors?

This project for the Hackaday Prize solves the problem of indoor navigation, and it does it in an amazingly clever way. This is using QR codes for navigation, but not just any QR codes. They’re QR codes read by an infrared camera, and painted on the walls and ceilings with a special IR sensitive paint that’s invisible to the human eye. It’s navigation for robotic vision, and it’s a fantastic idea.

The basic idea behind this project is to use an IR camera — or basically any webcam with the IR blocking filter removed — and a massive amount of IR LEDs to illuminate any target. So far, the proof of concept works. A computer can easily read QR codes, and if paint is invisible to the human eye but visible to an IR camera, the entire project is merely a matter of implementation.

There have been a number of projects that try to add indoor navigation to robots. Some of them use LIDAR, some use computer vision and SLAM. These are computationally expensive. Some even use wireless beacons to navigate indoors like the SubPos Ranger from the 2016 Hackaday Prize. Using IR and QR codes is just so simple and hacker-friendly, and we think it’s fantastic.

IR Detective Eases Development With Compact Decoding

April 27, 2018 by Donald Papp 13 Comments

Hardware development often involves working with things that can’t be directly perceived, which is one reason good development tools are so important. In appreciation of this, [David Johnson-Davies] created the IR Remote Control Detective to simplify working with IR signals. While IR remote controls are commonplace, there are a number of different protocols and encoding methods in use across different brands. The IR Detective takes care of all of that with three main components, none of which are particularly expensive. To use the decoder, one simply points an IR remote at the unit and presses one of the buttons. The IR Detective will identify the protocol, decode the signal, and display the address and command related to the key that was pressed. The unit doesn’t consist of much more than an ATtiny85 microcontroller, a small OLED display, and an IR receiver unit. The IR receiver used is intended for a 38 kHz carrier, but such receivers can and do respond to signals outside this frequency, although they do so at a reduced range.

As a result, not only is the unit useful for decoding IR or verifying that correct signals are being generated, but the small size and low cost means it could easily be used as a general purpose receiver to add IR remote control to other devices. It’s also halfway to bridging IR to something else, like this WiFi-IR bridge which not only interfaces to legacy hardware, but does it across WiFi to boot.

Motion-Controlled KVM Switch

April 16, 2018 by James Hobson 7 Comments

Once upon a time, [hardwarecoder] acquired a Gen8 HP microserver that he began to toy around with. It started with ‘trying out’ some visualization before spiraling off the rails and fully setting up FreeBSD with ZFS as a QEMU-KVM virtual machine. While wondering what to do next, he happened to be lamenting how he couldn’t also fit his laptop on his desk, so he built himself a slick, motion-sensing KVM switch to solve his space problem.

At its heart, this device injects DCC code via the I2C pins on his monitors’ VGA cables to swap inputs while a relay ‘replugs’ the keyboard and mouse from the server to the laptop — and vice-versa — at the same time. On the completely custom PCB are a pair of infrared diodes and a receiver that detects Jedi-like hand waves which activate the swap. It’s a little more complex than some methods, but arguably much cooler.

Using an adapter, the pcb plugs into his keyboard, and the monitor data connections and keyboard/mouse output to the laptop and server stream out from there. There is a slight potential issue with cables torquing on the PCB, but with it being so conveniently close, [hardwarecoder] doesn’t need to handle it much.

Continue reading “Motion-Controlled KVM Switch” →

No, Cat, This Is Not The Litter Box

March 4, 2018 by James Hobson 39 Comments

Hackaday.io user [peterquinn] has encountered a problem with his recently unruly cat peeing under the dining table. Recognizing that the household cat’s natural enemy is the spray bottle, he built an automatic cat sprayer to deter her antics.

The build is clear-cut: an Arduino Uno clone for a brain, an MG995 servo, PIR sensor, spray bottle, and assorted electronics components. [peterquinn] attached the servo to the spray bottle with a hose clamp — ensuring that the zero position is pointing at the trigger — and running a piece of cabling around the trigger that the servo will tug on. Adding a capacitor proved necessary after frying the first Uno clone, as the servo powering up would cause the Uno to reset.

The code is set up to trigger the servo — spraying the cat twice — once the PIR detects the cat for more than ten seconds. After toying with a few options, [peterquinn] is using a 9V, 2A power supply that works just fine. For now, he hopes the auto-sprayer should do the trick. If it somehow doesn’t work, [peterquinn] has mused that a drastic upgrade to the vacuum may be necessary.

Tachometer Uses Light, Arduinos

February 24, 2018 by Bryan Cockfield 19 Comments

To measure how fast something spins, most of us will reach for a tachometer without thinking much about how it works. Tachometers are often found in cars to measure engine RPM, but handheld units can be used for measuring the speed of rotation for other things as well. While some have mechanical shafts that must make physical contact with whatever you’re trying to measure, [electronoobs] has created a contactless tachometer that uses infrared light to take RPM measurements instead.

The tool uses an infrared emitter/detector pair along with an op amp to sense revolution speed. The signal from the IR detector is passed through an op amp in order to improve the quality of the signal and then that is fed into an Arduino. The device also features an OLED screen and a fine-tuning potentiometer all within its own self-contained, 3D-printed case and is powered by a 9 V battery, and can measure up to 10,000 RPM.

The only downside to this design is that a piece of white tape needs to be applied to the subject in order to get the IR detector to work properly, but this is an acceptable tradeoff for not having to make physical contact with a high-speed rotating shaft. All of the schematics and G code are available on the project site too if you want to build your own, and if you’re curious as to what other tools Arduinos have been used in be sure to check out the Arduino-based precision jig.

Continue reading “Tachometer Uses Light, Arduinos” →